This means we see a bug long after it happened, so we can't correlate it to the cause.

It's fine as an option (even the default) but I'd like to be able to audit after every operation. Perhaps a partial audit that only looks at the gfns and vaddrs that were affected in the last operation?